Places

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:03 PM UTC
• Version: 2.0.1

Overview

The skill’s place lookup behavior is coherent, but its mutable installer commands and broad companion-skill install path deserve review before use.

Review the installer path before installing: prefer a pinned, reviewed version or commit and install only camino-places rather than the full suite unless you need the other skills. Use a limited Camino API key if possible, and avoid submitting private home addresses or sensitive locations unless you are comfortable sending them to Camino's API.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Unpinned Third-Party Installation Commands Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17–26
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

Vulnerable Code

bash

# Install all skills from repo
npx skills add https://github.com/barneyjm/camino-skills

# Or install specific skills
npx skills add https://github.com/barneyjm/camino-skills --skill camino-places

bash

npx clawhub@latest install camino-places
# or: pnpm dlx clawhub@latest install camino-places
# or: bunx clawhub@latest install camino-places

Technical Analysis

The installation instructions execute npm packages identified by the mutable latest tag and install Skill content from a GitHub repository without pinning it to a reviewed commit SHA. Consequently, the code retrieved when a user runs these commands can differ from the code that was originally audited.

The command that installs all Skills also expands the trusted codebase beyond the component needed for place lookup. Neither package versions, repository commit identifiers, integrity hashes, nor cryptographic signatures are specified.

This is a supply-chain weakness rather than evidence that the currently reviewed scripts/places.sh file is malicious. Exploitation requires compromise or malicious modification of an upstream package, publisher account, repository, or mutable release.

Attack Path

1. An attacker compromises the npm publisher account, package distribution channel, GitHub account, or upstream repository referenced by the documentation.
2. The attacker publishes a malicious package under the latest tag or modifies the repository's default branch.
3. A user follows one of the documented installation commands.
4. npx, pnpm dlx, or bunx downloads and executes the mutable package, or the installer retrieves modified Skill content from the repository.
5. Malicious installation or lifecycle code executes with the privileges of the ...[truncated 587 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an explicitly reviewed and immutable package version.
• Pin the GitHub dependency to a reviewed commit SHA rather than the repository's mutable default branch.
• Publish and verify integrity hashes or cryptographic signatures for released packages and Skill bundles.
• Document the expected package publisher, version, commit identifier, and checksum so users can verify provenance before installation.
• Recommend installation of only camino-places rather than the complete Skill suite unless the additional components are explicitly required.
• Use lockfiles and automated dependency scanning in the release process.
• Review package lifecycle scripts and retrieved Skill contents before promoting a new pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

Add your key to Claude Code:

Add to your ~/.claude/settings.json:

json

{

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares shell-capable behavior through scripts and curl usage but does not define an explicit tool scope such as permissions or allowed-tools. In an agent environment, this can cause overbroad execution authority, making it easier for the skill to invoke shell actions beyond the minimally required set.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 82% confidence

Finding

The installation command uses npx skills without a pinned version, so consumers may fetch and execute whatever package version is current at install time. This creates a supply-chain risk where a compromised or maliciously updated package could execute arbitrary code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 82% confidence

Finding

This second npx skills invocation is also unpinned and carries the same supply-chain exposure as the first. Users following the documentation may unknowingly execute changed code from the package registry.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The command npx clawhub@latest install camino-places explicitly tracks the latest version, which maximizes exposure to unexpected upstream changes or registry compromise. Running package-manager bootstrap commands from documentation can result in arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

./scripts/places.sh '{"city": "San Francisco", "state": "California", "limit": 5}'

text

### Via curl (direct API calls)

The skill is named `camino-places` but calls the `/search` API endpoint. For direct API calls:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script sends user-supplied location and address data to a third-party API, which can include sensitive personal information such as home addresses or searched places. While this is necessary for geocoding functionality, the lack of disclosure, consent, or data-minimization controls creates a privacy risk because users may not realize their data is leaving the local environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md

curl -s -X POST \
    -H "X-API-Key: $CAMINO_API_KEY" \
    -H "X-Client: claude-code-skill" \
    "https://api.getcamino.ai/search?${QUERY_STRING}" | jq .

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/places.sh (reported line 97)May include surrounding context.

sh

curl -s -X POST \
    -H "X-API-Key: $CAMINO_API_KEY" \
    -H "X-Client: claude-code-skill" \
    "https://api.getcamino.ai/search?${QUERY_STRING}" | jq .

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The manifest describes geocoding and place lookup, which does justify making a remote API request, but it does not mention handling credentials or reading secrets from the runtime environment. Accessing environment-stored API keys is an additional capability beyond the user-facing purpose, even though it is commonly used to support external API access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.